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1 . (Amended) A method for designing {the} a control of a complete process 
which comprises a number of individual processes, said method comprising the 
steps of: 

a) identifying [a) in wh i ch] functionalities of {the} said individual processes [am 
i d e nt i fi e d,] ! 

[b) i n wh i ch] bl performing a validation [ is p e rform e d] by automatically verifying 

an interplay of {the} said functionalities in accordance with an input to [the} 
said complete process, [to th e e ff e ct th a t] while not impeding each 
individual process M s not i mp e d e d dur i ng th e op e rat i on.] during an 
operation, producing a validation result; and 

[c) i n wh i ch] c) determining data for controlling [the} said complete process 

[ar e d e t e rm i n e d from a r es u l t of th e ] from said validation result . 

2. (Amended) The method as claimed in claim 1 , [ i n wh i ch] further 
comprising the step of performing a sequence optimization [ i s p e rform e d i n 
add i t i on to s t e p 1c).] . 

(Amended) The method as claimed in claim 1 [or 2, i n wh i ch th e data 
for th e control a r e d e t e rm i n e d i n th e form of] , further comprising the step of 
producing data for said control in an executable code form. H 
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4. (Amended) The method as claimed in [on e of claim s 1 to 3, in wh i ch on e 
of th e function ali t ies of th e i ndiv i dua l proc esses is a s oftwar e un i t for contro l ling th e 
ind i v i du al proc ess a ff e ct e d. 1 claim 1. further comprising the step of controlling 
individual affected processes by a software unit which is one of said 
functionalities of said individual processes. 

(Amended) The method as claimed in [on e of th e pr e c e ding cla i ms, i n 
wh i ch a n i nd i v i du al proc ess is imp e d e d] claim 1. wherein one or more of said 
individual processes may be an impeding process, an impeding process being 
defined as such if one of the following conditions is met: 

a) [the] an individual process is blocked by another individual process; and 

b) [the} an individual process reaches an unauthorized state or a state 
endangering {the} operation of [the) said complete system. 

6. (Amended) The method as claimed in [on e of th e pr e c e d i ng c la im s , i n 
which th e control of i nd i v i du al proc esse s of] claim 1, further comprising the steps 
of: 

designing an automatic placement machine [ is d esi gn e d. ] ; and 
[ ^controlling individual processes of said machine. 

7. (Amended) The method as claimed in [on e of th e pr e c e d i ng cl ai ms, i n 
wh i ch th e ] claim 1, further comprising the step of controlling a technical 
installation with data determined for controlling [the} said complete process {a*e 
u se d for contro ll ing a t e chn i c al i n s t alla t i on.] . 

[8 ^18. (Amended) An arrangement for designing the control of a complete 
process [which compr ises ] , comprising: 

a number of individual processes ^ compri s ing] ; and 
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a processor unit [wh i ch is se t up i n s uch a m a nn e r th a t] configured to 
provide: 

{a)-}a) identification of functionalities of {the} said individual processes {can 
b e i d e nt i fi e d] ; 

b) a validation [c a n b e p e rform e d^ by automatically verifying an interplay 
of {the} functionalities in accordance with an input to [the} said 
complete process, [to th e e ff e ct] in a manner such that each of said 
individual [proc ess ] processes is not impeded during {the} an 
operation; and 

c) data from a result of {the] said validation [can b e ] that is used for 
controlling {the} said complete process. 
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[D es cript i on] SPECIFICATION 
[M e thod and arrang e m e nt for d es igning th e contro l of a compl e t e prococcl TITLE 
METHOD AND ARRANGEMENT FOR DESIGNING THE CONTROL OF A 

COMPLETE PROCESS 
BACKGROUND OF THE INVENTION 

Field of the Invention 

The invention relates to a method and an arrangement for designing the 
control of a complete process which comprises a number of individual processes. 

Description of the Related Art 

The control of a complex technical installation or [, r es p e ct i v e ly,] of a system 
fQ(a complete process) comprises a number of smaller control units which are 
provided for certain parts (individual processes) of the installation or [, r es p e ct i v el y,] 
of the system. A first control unit for a first individual process is restricted iri this case 
to this individual process. The same applies to a second control for a second 
individual process. Even if an interplay of the first control with the second control 
functions largely without errors, this does not guarantee that an error-free operation 
of the complete installation is still guaranteed with a slight modification of the first or 
of the second individual process. Thus, a small change in [ a proc ess ] one of these 
processes or the addition of a third process can lead to conflicts and blocking 
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between the processes which can only be empirically verified. In this context, it is 
possible that a faulty state of the complete process overcomes an empirical test and 
thus remains undetected. This is not acceptable* especially with regard to a critical 
installation with respect to safety since it must be guaranteed in every case that no 
un predicted event occurs in the interplay of the processes. 

Apart from the unauthorized states to be avoided, there are x in the sequence 
of a process [go ca ll od a uthoriz e d stat e s] . "authorized states" which should occur 
exclusively for the process if it is functioning correctly. 

SUMMARY OF THE INVENTION 

It is the object of the invention to specify a method and an arrangement for 
designing the control of a complete process in which it is (formally) ensured that 
there is no impediment to the individual processes and that only authorized states 
are occupied. 

This object is achieved [ i n accordanc e w i th th e f e atur es of th e i nd e p e nd e nt 
c l a i m 6 .1 by a method for designing a control of a complete process which 
comprises a number of individual processes, the method comprising the steps 
of: identifying functionalities of the individual processes; performing a 
validation by automatically verifying an interplay of the functionalities in 
accordance with an input to the complete process, while not impeding each 
individual process during an operation, producing a validation result: and 
determining data for controlling the complete process from the validation 
result. 

[W i th i n th e cont e xt of th e i nv e nt i on,! This object is also achieved by an 
arrangement for designing the control of a complete process, comprising a 
number of individual processes: and a processor unit configured to provide: a) 
identification of functionalities of the individual processes: b) a validation, by 
automatically verifying an interplay of functionalities in accordance with an 
input to the complete process, in a manner such that each of the individual 
processes is not impeded during an operation: and c) data from a result of the 
validation that is used for controlling the complete process. 

Further developments of the invention include providing a method step 
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of performing a sequence optimization. A step of producing data for the 
control in an executable code form may be provided, as may a step of 
controlling individual affected processes by a software unit which is one of the 
functionalities of the individual processes. One or more of the individual 
processes may be an impeding process, an impeding process being defined 
as such if one of the following conditions is met: an individual process is 
blocked by another individual process: and an individual process reaches an 
unauthorized state or a state endangering operation of the complete system. 
The inventive method may be applied to controlling individual processes of an 
automatic placement machine, and may also involve controlling a technical 
installation with data determined for controlling the complete process. 

In more detail, the invention relates to a method for designing the control of 
a complete process which comprises a number of individual processes [i s s p e c i fi e d] . 
In the method, functionalities of the individual processes are identified. Furthermore, 
a validation is performed by automatically verifying an interplay of the functionalities 
in accordance with an input to the complete process, to the effect that each 
individual process is not disturbed during the operation. From the result of the 
validation, data for controlling the complete process are determined. 

An advantage of the method [con sis t s i n] is that [it is e n s ur e d in] the step of 
validation ensures that each individual process can run undisturbed. A further 
advantage [con sis t s i n th e a utomat i c g e n e r a tion of d a t a l is that data is 
automatically generated for controlling the complete process. Thus, data for 
controlling the complete process are systematically generated with the aid of the 
method. 

An embodiment [con sis t s ] is provided in [that] which a sequence 
optimization is performed after the validation. [Thu s , i t is c e rt ai n l y an advant a g e that] 
Advantageously, individual processes can run undisturbed [and a noth e r advantag e 
con s i s t s i n that] ; furthermore, the several individual processes can run time- 
optimized if possible. It is the aim of the sequence optimization to carry out the 
performance of predetermined actions of the several individual processes in parallel 
and in the shortest possible time without disturbances. 

A further development [con sis t s i n] is that the data for controlling the complete 
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process are determined in the form of an executable code. This ensures that the 
result of the validation and possibly of the sequence optimization flows completely 
automatically into the control of the complete process. For example, a program code 
written in the programming [ la ngu a g e C or th e progr a mm i ng l angu a g e ] languages C 
or C++ is generated which initiates or ensures the control of the complete process. 

In particular, the advantage becomes noticeable in the generation of 
executable code if functionalities of the individual processes are also provided in the 
form of respective program units. If a number of functionalities in each of a number 
of individual processes [ i n ea ch] correspond to at least one program unit, the data 
which were generated in the form of executable codes are used for controlling the 
coordination of the individual program units or, respectively, the executable code 
uses the interfaces, e.g^ function calls or method calls, provided by the program 
units. 

It is also a further development that an individual process is disturbed if one of 
the following conditions is met: 

a) The individual process is blocked by another individual process. In the case of 
the blocking, two individual processes wish to use one physical resource in 
different ways. In such a case, blocking occurs since the resource cannot 
meet the requirements of both individual processes at the same time. 

b) The individual process reaches an unauthorized state or a state endangering 
the operation of the complete system. It is an essential requirement for a 
critical application with respect to safety that no hazardous states are 
assumed. ' 

[ I n th e cont e xt of th e ] The invention^] also provides an arrangement for 
controlling a complete process [ is als o s p e cifi e d, wh i ch compl e t e proc ess ] that 
comprises a number of individual processes, a processor unit being provided which 
is set up in such a manner that functionalities of the individual processes can be 
identified. Furthermore, a validation can be performed by automatically verifying an 
interplay of the functionalities in accordance with an input to the complete process to 
the effect that each individual process is not impeded during the operation. Finally, 
the data resulting from the result of the validation can be used for controlling the 
complete process. 
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This arrangement is particularly suitable [, in part i cular,] for carrying out the 
method according to the invention or one of its further developments explained 
above. 

[Furth e r d e v e lopm e nt s of th e i nv e nt i on a r e als o obt ai n e d from th e d e p e nd e nt 
etaimsj BRIEF DESCRIPTION OF THE DRAWINGS 

In the text which follows, exemplary embodiments of the invention are shown 
and explained with reference to the [drawing, i n wh i ch:] drawings. 
[Fig. 1 s how s ] Fig. 1 is a schematic diagram showing a turret head of an 

automatic placement machine; 
Fig. 2 [ s how s ] is a flowchart showing steps of a method for generating the control 

of a complete process; 
Fig. 3 [ s how s ] is a state [m a ch i n e wh i ch r e pr ese nt s ] diagram showing the system 

behavior of the "scan" operation; 
Fig. 4 [ s how s ] is a state [mach i n e which r e pr ese nt s ] diagram showing the specific 

system behavior of the scan test; 
Fig. 5 [ s how s ] is a state [mach i n e wh i ch r e pr ese nt s ] diagram showing a sequential 

processing of the vacuum test and of the scan test; 
Fig. 6 [ s how s ] is a state diagram illustrating two state machines which represent a 

parallel processing of the vacuum test and of the scan test; 
Fig. 7 [ s how s a numb e r of s tat e mach i n es wh i ch r e pr ese nt] are state diagrams 

showing a system behavior; 
Fig. 8 [ s how s ] is a state [mach i n e wh i ch r e pr ese nt s ] diagram showing a specific 

system behavior (error recovery) ;k J 
[Fig. 9 s how 6 ] Figs. 9A & B are two state [m a ch i n es ] diagrams which in each 

case [r e pr ese nt] show specific system behavior for the vacuum test and the 

scan test; 

[Fig. 10 s how s ] Figs. 10A & B are parts of a state [m a chin e for] diagram 
showing the complete process. 

DESCRIPTION OF THE PREFERRED EMBODIMENTS 

Figure 1 shows an exemplary embodiment having a turret head 101 of an 
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automatic placement machine. The turret head 101 accepts components and places 
them at a predetermined target position. The turret head contains 12 vacuum 
pipettes 102 which are used as receptacle and placement tool, If the turret head 101 
is used for a prolonged period, wear occurs, and the vacuum pipettes become dirty 
and worn. Accordingly, it is necessary to perform periodic tests in order to determine 
the state of the vacuum pipettes 102 and to exchange them, if necessary. Two 
different tests are performed by two different C programs. A vacuum test 103 is used 
for finding out whether the respective vacuum pipette 102 can still generate the 
intended vacuum; a scan test 104 indicates the extent to which the individual 
vacuum pipette 1 02 is subject to physical wear and whether it needs to be 
exchanged. For {the} subsequent observations, the scan test 104 and the { 
Jvacuum test 103 access one and the same resource: the rotation of the turret head 
101. 

The text which follows explains how the control of a complete process is 
determined, guaranteeing freedom from conflict and providing for the execution of 
the vacuum test 103 and the scan test 104 at the same time without the complete 
process being able to assume unpredicted states. For this purpose, the function calls 
of the [abov e m e ntion e d] previously mentioned C programs must be coordinated. 

Figure 2 shows steps of a method for generating the control of a complete 
process. 

In a step 201, functionalities of the individual processes are identified 
(structuring) f. Furth e rmor e . 1 , as well as controllable and uncontrollable events {a*e 
i d e nt i fi e d] . Controllable events are events which can be avoided by the control. 
Uncontrollable events are events which cannot be avoided, e.g.* output values of 
sensors or results of actions. Furthermore, sequences of events are identified which 
represent a possible physical system behavior. In addition, sequences of events are 
identified which represent a specific system behavior (task-related system behavior) 
under the influence of the control. 

The step of structuring 201 also comprises the representation of a state 
machine as shown in figure 3 for the "scan behavior". 

From an initial state 301, a "scan" command places the machine into a state 
302 in which the vacuum pipette 102 is examined for wear. If the "scanning" is 
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concluded, the machine returns to state 301 . Similarly, the machine returns to { 
Jstate 301 from state 302 when an error occurs f fl(e.g. t error: the process of 
scanning indicates that the vacuum pipette 102 must be replaced). A "recover" 
command changes state 301 to a state 303 in which the machine returns to the 
starting conditions (recovering). If the "recovering" process is ended, the machine 
jumps back into state 301 ("done recover"). 

The specific system behavior is also shown in the form of a state [m a chin e ] 
machine/diagram . For this purpose, [figur e A] Figure 4 shows a state machine 
which corresponds to the specific system behavior for the coordination of the events 
"turn", "done turn", "error turn", "scan", "done scan", "error scan", and "counter. 

Figure 4 shows a state machine which represents the specific system 
behavior of the scan test 1 04. An initial state 401 is changed to a state 402 by a 
"turn" command. If the turning of the turret head 101 is ended, the machine changes 
from state 402 to a state 403. If an error occurs during the turn ("error turn"), state 
402 changes to a state 407. From state 403, the "scan" command initiates a change 
to a state 404; when the scan test 104 is concluded, the machine changes from state 
404 to a state 405. Incrementing a counter changes state 405 to a state 406. A 
check is then made to determine whether the counter has already reached a [va l u e 
42] particular value, e.g., 12 for a turret heat having 12 pipettes . If this is so, 
state 406 is changed to state 407; if the counter exhibits a smaller value than 1 2, 
state 406 changes to state 401 . Various commands ensure that state 407 is kept: 
"recover", "done recover", "operator input", and "stop". A "repeat" command causes 
the process to be repeated in that state 407 is changed to state 401 . 

A next step 202 in figure 2 ensures a validation of the control of the complete 
process by automatically verifying characteristics of the complete process. Such 
characteristics are, in particular, a blocking or non-blocking characteristic and a 
controllability characteristic. If various individual processes are operating in parallel 
with one another and if these individual processes share one or more resources (in 
this case the turning of the turret head 101 ) f freedom from blocking is ensured if the 
individual processes can perform their tasks right to the end without impeding each 
other by accessing common resources. In the exemplary embodiment shown, the 
individual process scan test 104 and the individual process vacuum test 103 jointly 
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use the resource "turning of the turret head 101". This could lead to mutual blocking 
if the control of the complete process does not [pr e v e nt thi s pr e v e ntativ e l y] avoid 
this in a preventative manner . 

Furthermore, the validation 202 is carried out in that a plausibility check of the 
structuring 201 of the complete process to be controlled is effected by observation or 
simulation of the system and of the specific system behavior in the form of a state 
machine. Finally, predetermined characteristics are automatically verified. One of 
these characteristics is { 

]"after an error has occurred in scan test 104 (the event "error scan" was indicated), 
the "recovery" operation (the event "recover") always starts". 

The validation 202, if it is not done completely and which formally verifies the 
undisturbed sequence of the individual processes, is repeated by branching back to 
step 201, the structuring of the functionalities of the individual processes. If the 
validation 202 is successful, code for controlling the complete process is 
automatically generated (compare change to step 203 in [f i gur e ] Figure 2). 

During this process, during the automatic generation of the control of the 
complete process, controllable events are allocated, in particular, to the linked 
function calls within the individual processes and thus to the associated program 
code fragments. Uncontrollable events are allocated to corresponding return values 
of function calls or output values of sensors. An example is represented by the 
function call of the event "scan" which relates to the corresponding program code 
fragment (C program routine "scan test") which comprises "scan error" or "scan 
done" as return values. 

The automatic generation of the C code for controlling the complete process 
is determined from various state machines, allocations and/or program code 
fragments. The individual functionalities structured in step 201 correspond in this 
case to the corresponding state machines or, respectively, program code fragments. 

As already mentioned, the vacuum test 103 and the scan test 104 are carried 
out in parallel, each test being performed at different physical locations (compare 
[figur e ] Figure 1 , noting the oppositely located performance of the two tests). 

Figures 5 and 6 show the desired behavior of the individual processes for the 
vacuum test 103 and the scan test 104, [figur e ] Figure 5 showing a sequential 
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processing of the two tests and [figur e ] Figure 6 showing a parallel processing of the 
two tests. In the parallel processing in [figur e ] Figure 6, blocking of the two 
individual processes can occur due to the fact that after the event "recovery 
vacuum", one of the two events "turn" or "counter" will not occur. As a result, a 
turning ("turn" command) of the cylinder head, which is needed by both individual 
processes running in parallel, is not guaranteed. [Wh e r eas on e ] One machine wants 
to turn the cylinder head, but the other machine [ 

jwants to increment the counter, resulting in blocking. In contrast, sequential 
processing as indicated in [fi g ur e] Figure 5 is possible, but the tests for 1 2 vacuum 
pipettes 102 each being performed in succession [ a nd thu s ] results in the cylinder 
head 101 having to be turned twice completely. The time expenditure for the 
sequential processing is far greater than for (almost) parallel processing. 

On the basis of [figur e ] Figure 4, [figur e ] Figure 5 to [figur e 10] Figure 10 can 
be analogously understood fp e r se . Thu 6 . figur e ] . Figure 5 comprises states 501 to 
517, figure 6 comprises states 601 to 618, states 501 to 509 and 509 to 517 
characterizing [the] in each case the independent machines according to [figur e ] 
Figure 6 which can run in parallel. The event which is in each case decisive for a 
state changing to another one is in each case indicated along the transition arrows in 
the figures. 

Events having the same name occur synchronously in machines in which the 
respective event is defined. In the present exemplary embodiment, the event "scan" 
occurs if the state machine of the system behavior (compare [figur e ] Figure 7) is in 
state "0" or, respectively, the state machine of the specific system behavior 
according to [f i gur e ] Figure 8 is in state 0 or in state 1 and if the state machine of the 
specific system behavior according to figure 9 is in state 2. 

Controllable events are: { 
]"turn", "scan", "vacuum", "recover", "recovery turn", "recovery scan", "recovery 
vacuum", "counter", "operator input", and "reset", f 
JUncontrollable events are: { 

]"done turn", "error turn", "done scan", "error scan", "done vacuum", "error vacuum", 
"done recover", M counter=12?", w counter<12?", "stop", and "repeat". 

The respective state machine indicates the state in which the corresponding 
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system behavior can be terminated, i.e., the state with a dark background defines a 
termination condition. 

Figure 7 shows [th e s y s tem b e h a vior. A s a lr e ady m e ntion e d abov e , th o 
s y s t e m b e hav i or shows] as sequences of events which represent physically possible 
system states. Such physically possible behaviors are the turning of the cylinder 
head, the performance of the vacuum test, the performance of the scan test, the 
incrementing and interrogating of the counter and the inputting of a command which 
triggers a predetermined action. The state 0 in [figur e ] Figure 7 characterizes both 
the initial state and the end state of the respective system behavior. 

After the system behavior has been identified, the specific system behavior is 
determined which relates to a behavior of the complete process with regard to the 
task to be controlled. The associated state machine for the specific system behavior 
of the error recovery is shown in [figur e ] Figure 8. In [figur e ] Figure 8, there are two 
marked states 801 and 807, state 801 being simultaneously the start and an end 
state of the state machine. The specific system behavior "error recovery" can be 
terminated in each case in states 801 and 807. 

According to the above statements, the validation is then performed. To this 
end, a number of iterations which, finally, lead to the solution according to [figur e ] 
Figure 7 to [figur e ] Figure 9 are shown according to [f i gur e ] Figure 2 (compare 
transition from validation 202 to structuring 201: iteration). 

Figures 8 and 9 show the controlled specific system behavior corresponding 
to the predetermined functionality of the complete process. For this purpose, three 
tasks have been identified { 

Jwhich are executed in parallel: error recovery, scan test t and vacuum test. The 
error recovery, in particular, is only activated if both the scan test 104 and the 
vacuum test 103 [[lacuna]] occur in a marked state (compare state 6 fofy 
r e sp e ctiv el y] in Figure 8 or states 907, 91 7 in [figuro 9)] Figures 9A & B 
respectively) . The scan test 104 and the vacuum test 103 are only activated if the 
error recovery is in the initial state (compare state 0 or 801 in [figur e ] Figure 8). 

The system behavior and the specific system behavior according to [figur es ] 
Figures 7-9 are non-blocking. Furthermore, the specific system behavior according 
to [figur es ] Figures 8 and 9 is controllable with respect to the system behavior from 
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Tfigur e 7.1 Figure 7. 

[ I n figur e 10] In Figures 10A & B (collectively. Figure 10) . the complete 
process is assembled from the state machines according to [figur es ] Figures 7-9. 
Figure 10 represents the product state machine of the state machines described 
[ a nd i s compr e h e n si b le p e r se ] above . In particular, the product state machine 
according to [figur e ] Figure 10 is not used for structuring and solving the control task 
for the complete process since the easily traceable procedure, as described, 
guarantees a structured and clear approach to determining the data which are 
necessary for controlling the complete process. 

The executable program code for controlling the complete process is 
automatically generated in that first function calls are assigned to the controllable 
events, the return values of the function calls or output values of sensors being 
assigned the corresponding uncontrollable events. The program code for controlling 
the complete process is generated from the state machine assignments and 
associated program code fragments. 

[Ab s tracti The above-described method and arrangement are illustrative 
of the principles of the present invention. Numerous modifications and 
adaptations thereof will be readily apparent to those skilled in this art without 
departing from the spirit and scope of the present invention. 



— n — 

MARK-UP FOR SUBSTITUTE SPECIFICATION 



[M e thod a nd arrang e m e nt for d esi gn i ng th e contro l of a comp le t e proces s ] 
ABSTRACT 

To prevent blocking between competing individual processes within a 
complete process, functionalities of the individual processes are identified and the 
[ i nt e rp la y] interplay/interaction of these functionalities is validated. The data 
obtained from the validation can be used for controlling the complete process. 
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